shortcutxl 0.3.67 → 0.3.68

package/CHANGELOG.md

@@ -1,9 +1,9 @@
 # Changelog
 
-## [0.3.67]
+## [0.3.68]
 
+- **Model availability fix** - Introducing GLM 5.2 and Pivot models for eligible individual CLI accounts, not teams plans.
 - **Persistent prompt history** — Your prompt history now persists across CLI sessions and can be accessed by up/down arrows.
-- **GLM 5.2** — Added the GLM 5.2 model with zero data retention.
 
 ## [0.3.65]
 

package/dist/ai/types.d.ts

@@ -148,6 +148,7 @@ export interface Tool<TParameters extends TSchema = TSchema> {
     name: string;
     description: string;
     parameters: TParameters;
+    normalizeArguments?: (args: unknown, toolCall: ToolCall) => unknown;
 }
 export interface Context {
     systemPrompt?: string;

package/dist/ai/utils/validation.js

@@ -23,6 +23,10 @@ if (!isBrowserExtension) {
         console.warn('AJV validation disabled due to CSP restrictions');
     }
 }
+function getValidationArgs(tool, toolCall) {
+    const args = structuredClone(toolCall.arguments);
+    return tool.normalizeArguments ? tool.normalizeArguments(args, toolCall) : args;
+}
 /**
  * Finds a tool by name and validates the tool call arguments against its TypeBox schema
  * @param tools Array of tool definitions
@@ -49,12 +53,12 @@ export function validateToolArguments(tool, toolCall) {
     if (!ajv || isBrowserExtension) {
         // Trust the LLM's output without validation
         // Browser extensions can't use AJV due to Manifest V3 CSP restrictions
-        return toolCall.arguments;
+        return getValidationArgs(tool, toolCall);
     }
     // Compile the schema
     const validate = ajv.compile(tool.parameters);
     // Clone arguments so AJV can safely mutate for type coercion
-    const args = structuredClone(toolCall.arguments);
+    const args = getValidationArgs(tool, toolCall);
     // Validate the arguments (AJV mutates args in-place for type coercion)
     if (validate(args)) {
         return args;

package/dist/ai/validation.d.ts

@@ -3,6 +3,7 @@ import type { ToolCall } from './types.js';
 interface ValidatedTool {
     name: string;
     parameters: TSchema;
+    normalizeArguments?: (args: unknown, toolCall: ToolCall) => unknown;
 }
 export declare function validateToolArguments<TArgs = unknown>(tool: ValidatedTool, toolCall: ToolCall): TArgs;
 export {};

package/dist/ai/validation.js

@@ -20,12 +20,16 @@ if (!isBrowserExtension) {
         console.warn('AJV validation disabled due to CSP restrictions');
     }
 }
+function getValidationArgs(tool, toolCall) {
+    const args = structuredClone(toolCall.arguments);
+    return tool.normalizeArguments ? tool.normalizeArguments(args, toolCall) : args;
+}
 export function validateToolArguments(tool, toolCall) {
     if (!ajv || isBrowserExtension) {
-        return toolCall.arguments;
+        return getValidationArgs(tool, toolCall);
     }
     const validate = ajv.compile(tool.parameters);
-    const args = structuredClone(toolCall.arguments);
+    const args = getValidationArgs(tool, toolCall);
     if (validate(args)) {
         return args;
     }

package/dist/app/background/tool-summaries.js

@@ -36,7 +36,8 @@ export async function generateToolSummaryDetailed(input, shortcutLlmProxy, optio
             ],
             max_output_tokens: maxOutputTokens,
             effort_level: 'low',
-            thinking_type: 'off'
+            thinking_type: 'off',
+            llmOperation: 'summarize'
         }, {
             signal
         });

package/dist/app/prompts/com-api.js

@@ -127,7 +127,13 @@ export function getExcelComApiGuidelines(filterTag) {
 ===========================
 ## Shortcut Wrapper API
 ===========================
-Workbook, Worksheet, and helpers are pre-injected in execute_code (no import needed).`;
+Workbook, Worksheet, and helpers are pre-injected in execute_code (no import needed).
+
+### ALWAYS start a task like this (app is already injected — do NOT import win32com or Dispatch Excel):
+names = [wb.Name for wb in app.Workbooks]        # find the target workbook name
+wb = Workbook(app.Workbooks("YourFile.xlsx"))    # wrap the COM object — NOT a filename string: Workbook("YourFile.xlsx") fails
+print(wb.getSheetNames())                         # use getSheetNames() — NOT wb.SheetNames
+ws = wb.getSheet("Sheet1")                        # use getSheet(name) — NOT wb.Worksheets(...)`;
     const sections = [COM_GUIDELINES, header];
     for (const [name, cls] of Object.entries(ref.interfaces)) {
         sections.push(renderSection(name, cls, filterTag));

package/dist/app/prompts/spreadjs-api-reference.json

@@ -4,7 +4,7 @@
       "functions": {
         "getAPIInfo": {
           "signature": "getAPIInfo(functionName: string): string;",
-          "docstring": "Retrieves extended API documentation for less common functions. Returns docstring, function signature, parameters, return types, and all parameter type definitions.\n\nMerging/unmerging cells: addSpanAt, removeSpanAt\nCopying: cutAndPasteRange (move/cut-paste within same workbook), copySheet (full sheet duplication within same workbook)\nSheet dimensions: setTotalRowCount, setTotalColumnCount, expandSheetToFit\n  - CRITICAL: SpreadJS initializes sheets with 10K rows and 100 columns. Writing to cells beyond these limits will SILENTLY FAIL unless you expand first!\n  - Example: sheet.expandSheetToFit(\"A60000\"); sheet.setCell(\"A60000\", \"data\");\nNamed ranges: getNamedRangeInfo, addNamedRange, removeNamedRange\n@example general.getAPIInfo(\"addSpanAt\");",
+          "docstring": "Retrieves extended API documentation for less common functions. Returns docstring, function signature, parameters, return types, and all parameter type definitions.\n\nMerging/unmerging cells: addSpanAt, removeSpanAt\nSizing (all in px coordinates): setColumnWidthAt, setRowHeightAt, autoFitColumnsAt\nCopying: cutAndPasteRange (move/cut-paste within same workbook), copySheet (full sheet duplication within same workbook)\nSheet dimensions: setTotalRowCount, setTotalColumnCount, expandSheetToFit\n  - CRITICAL: SpreadJS initializes sheets with 10K rows and 100 columns. Writing to cells beyond these limits will SILENTLY FAIL unless you expand first!\n  - Example: sheet.expandSheetToFit(\"A60000\"); sheet.setCell(\"A60000\", \"data\");\nNamed ranges: getNamedRangeInfo, addNamedRange, removeNamedRange\n@example general.getAPIInfo(\"addSpanAt\");",
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
@@ -221,6 +221,12 @@
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
+        "autoFitColumnsAt": {
+          "signature": "autoFitColumnsAt(columnRange: string): void;",
+          "docstring": "Auto-fit the columns specified by columnRange e.g. autoFitColumnsAt(\"A:G\");\n@example sheet.autoFitColumnsAt(\"A:G\");",
+          "usedTypes": [],
+          "tags": ["hidden", "approval"]
+        },
         "clearFormatting": {
           "signature": "clearFormatting(range: string, properties?: (keyof Style)[]): void;",
           "docstring": "Clear formatting from a range of cells. Clears all formatting if no properties specified.\nPass specific Style keys to clear only those properties.",
@@ -245,12 +251,24 @@
           "usedTypes": [],
           "tags": ["action", "approval"]
         },
+        "setColumnWidthAt": {
+          "signature": "setColumnWidthAt(columnLetter: string, width: number): void;",
+          "docstring": "Set explicit width for the given column in pixels. Default column width is 72px.\n@example setColumnWidthAt(\"A\", 100);",
+          "usedTypes": [],
+          "tags": ["action", "approval"]
+        },
         "getDependentCells": {
           "signature": "getDependentCells(address: string): string;",
           "docstring": "Get all cells that depend on the given cell",
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
+        "setRowHeightAt": {
+          "signature": "setRowHeightAt(rowAddress: string, height: number): void;",
+          "docstring": "Set explicit height for the given row in pixels. Default row height is 21px.\n@example setRowHeightAt(\"1\", 100);",
+          "usedTypes": [],
+          "tags": ["hidden", "approval"]
+        },
         "addSpanAt": {
           "signature": "addSpanAt(address: string, rowCount: number, colCount: number): void;",
           "docstring": "Merge a range starting from the cell at address (e.g., \"A1\")",

package/dist/app/providers/register-shortcut-provider.js

@@ -33,6 +33,50 @@ const BUILTIN_STREAM_BY_TRANSPORT = {
     'openai-responses': streamSimpleOpenAIResponses,
     'google-vertex': streamSimpleGoogleVertexGateway
 };
+function headerValue(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function isMainAgentStreamOptions(options) {
+    if (!options)
+        return false;
+    return (typeof options.convertToLlm === 'function' ||
+        options.userMessageId !== undefined ||
+        options.agentMode !== undefined ||
+        options.initialFileId !== undefined ||
+        options.fileAttachmentIds !== undefined ||
+        options.interactionMode !== undefined ||
+        options.speed !== undefined);
+}
+function createShortcutApiV2AttributionHeaders(options) {
+    const attribution = options;
+    const headers = {
+        'X-Agent-Runtime': 'shortcutxl_cli'
+    };
+    const userMessageId = headerValue(attribution?.userMessageId);
+    if (userMessageId)
+        headers['X-Turn-Id'] = userMessageId;
+    const agentMode = headerValue(attribution?.agentMode);
+    if (agentMode)
+        headers['X-Agent-Mode'] = agentMode;
+    const interactionMode = headerValue(attribution?.interactionMode);
+    if (interactionMode)
+        headers['X-Interaction-Mode'] = interactionMode;
+    const llmOperation = headerValue(attribution?.llmOperation) ??
+        (isMainAgentStreamOptions(attribution) ? 'chat' : undefined);
+    if (llmOperation)
+        headers['X-LLM-Operation'] = llmOperation;
+    const initialFileId = headerValue(attribution?.initialFileId);
+    if (initialFileId)
+        headers['X-Initial-File-Id'] = initialFileId;
+    if (attribution?.fileAttachmentIds?.length) {
+        headers['X-File-Attachment-Ids'] = attribution.fileAttachmentIds.join(',');
+    }
+    if (attribution?.speed === 'fast' || attribution?.speed === 'standard') {
+        headers['X-Shortcut-Speed'] = attribution.speed;
+    }
+    return headers;
+}
 /**
  * Dispatch a Shortcut model to its provider-native stream function, routed at
  * the api-v2 gateway with Shortcut auth. `options.apiKey` is the Shortcut
@@ -53,7 +97,8 @@ export function createShortcutApiV2Dispatcher(getExtraHeaders) {
         const shortcutToken = options?.apiKey ?? '';
         const authHeaders = {
             Authorization: `Bearer ${shortcutToken}`,
-            ...getExtraHeaders()
+            ...getExtraHeaders(),
+            ...createShortcutApiV2AttributionHeaders(options)
         };
         // Present the model to the native stream function under its real transport,
         // with the base URL shaped the way that transport's SDK expects (the OpenAI

package/dist/app/providers/shortcut-llm-proxy-client.d.ts

@@ -14,6 +14,7 @@ export interface ShortcutLlmAttribution {
     sessionId?: string;
     userMessageId?: string;
 }
+export type ShortcutLlmProxyOperation = 'code_preview' | 'compaction' | 'file_naming' | 'formula_trace' | 'llm_analysis' | 'sandbox_llm' | 'screenshot' | 'sentiment_analysis' | 'subagent' | 'suggestions' | 'summarize';
 /**
  * A helper LLM request. `messages` uses the simplified role/content shape
  * callers already build (`system`/`human`, string or OpenAI-style content
@@ -28,6 +29,7 @@ export interface ShortcutLlmProxyRequest {
     max_tokens?: number;
     max_output_tokens?: number;
     speed?: 'fast' | 'standard';
+    llmOperation?: ShortcutLlmProxyOperation;
 }
 export interface ShortcutLlmMessage {
     role: 'system' | 'human' | 'user' | 'ai' | 'assistant';

package/dist/app/providers/shortcut-llm-proxy-client.js

@@ -43,6 +43,8 @@ export function mapShortcutLlmProxyError(error) {
 }
 /** Parse an OpenAI-style data URI (`data:<mime>;base64,<data>`) into parts. */
 function parseDataUri(url) {
+    // [\s\S]* matches everything (incl. newlines) without the `s` dotAll flag,
+    // which requires an es2018+ target; keeps this parser target-agnostic.
     const match = /^data:([^;]+);base64,([\s\S]*)$/.exec(url);
     if (!match)
         return undefined;
@@ -108,6 +110,18 @@ function collectAssistantText(events) {
         return text;
     })();
 }
+function createShortcutLlmProxyHeaders(request, attribution) {
+    const headers = {};
+    if (attribution?.sessionId)
+        headers['X-Session-Id'] = attribution.sessionId;
+    if (attribution?.userMessageId)
+        headers['X-Turn-Id'] = attribution.userMessageId;
+    if (request.llmOperation)
+        headers['X-LLM-Operation'] = request.llmOperation;
+    if (request.speed)
+        headers['X-Shortcut-Speed'] = request.speed;
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Create a Shortcut helper LLM client backed by the model registry's native
  * transport path (api-v2). All helper calls share the main agent's transport.
@@ -129,9 +143,7 @@ export function createShortcutLlmProxyClient(options) {
                 throw new ShortcutLlmProxyError('missing-transport', `No stream transport registered for model "${request.model}" (api ${model.api}).`);
             }
             const attribution = options.getAttribution?.();
-            const headers = attribution?.sessionId
-                ? { 'X-Session-Id': attribution.sessionId }
-                : undefined;
+            const headers = createShortcutLlmProxyHeaders(request, attribution);
             const stream = apiProvider.streamSimple(model, toContext(request), {
                 apiKey,
                 maxTokens: request.max_tokens ?? request.max_output_tokens,

package/dist/app/tools/execute-tool.d.ts

@@ -12,6 +12,11 @@ declare const schema: import("@sinclair/typebox").TObject<{
     tool_name: import("@sinclair/typebox").TString;
     parameters: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>;
 }>;
+/**
+ * Auto-fix when LLM passes target tool params flat instead of nested in 'parameters'.
+ * Example: { tool_name: "loop", action: "start" } → { tool_name: "loop", parameters: { action: "start" } }
+ */
+export declare function normalizeExecuteToolArgs(raw: unknown): unknown;
 export declare function createExecuteToolTool(registry: ExecutableToolEntry[]): ToolDefinition<typeof schema>;
 export {};
 //# sourceMappingURL=execute-tool.d.ts.map

package/dist/app/tools/execute-tool.js

@@ -7,6 +7,7 @@
  * Modeled after backend/agent/tools/execute_tool.py.
  */
 import { Type } from '@sinclair/typebox';
+import { parseStringifiedParameters } from '../../contracts/host-tool.js';
 import { EXECUTE_TOOL } from '../../tool-names.js';
 // ---------------------------------------------------------------------------
 // Schema
@@ -19,31 +20,43 @@ const schema = Type.Object({
         description: 'Dictionary of parameters to pass to the tool. Keys must match the parameter names from get_tool_info.'
     })
 });
-// ---------------------------------------------------------------------------
-// Auto-nesting fix
-// ---------------------------------------------------------------------------
 /**
  * Auto-fix when LLM passes target tool params flat instead of nested in 'parameters'.
  * Example: { tool_name: "loop", action: "start" } → { tool_name: "loop", parameters: { action: "start" } }
  */
-function autoNestFlatParameters(raw) {
-    if ('parameters' in raw) {
+export function normalizeExecuteToolArgs(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
         return raw;
+    const value = raw;
+    const normalized = { ...value };
+    if (typeof normalized.tool_name === 'string') {
+        normalized.tool_name = normalized.tool_name.trim();
+    }
+    if ('parameters' in normalized) {
+        normalized.parameters = parseStringifiedParameters(normalized.parameters);
+        return normalized;
     }
     const knownFields = new Set(['tool_name']);
     const extra = {};
-    for (const [key, value] of Object.entries(raw)) {
+    for (const [key, paramValue] of Object.entries(normalized)) {
         if (!knownFields.has(key)) {
-            extra[key] = value;
+            extra[key] = paramValue;
         }
     }
-    if (Object.keys(extra).length > 0 && typeof raw.tool_name === 'string') {
+    if (Object.keys(extra).length > 0 && typeof normalized.tool_name === 'string') {
         return {
-            tool_name: raw.tool_name,
+            tool_name: normalized.tool_name,
             parameters: extra
         };
     }
-    return raw;
+    return normalized;
+}
+function normalizeParams(raw) {
+    const normalized = normalizeExecuteToolArgs(raw);
+    if (!normalized || typeof normalized !== 'object' || Array.isArray(normalized)) {
+        return raw;
+    }
+    return normalized;
 }
 // ---------------------------------------------------------------------------
 // Description
@@ -64,8 +77,9 @@ export function createExecuteToolTool(registry) {
         isReadOnly: false,
         description: DESCRIPTION,
         parameters: schema,
+        normalizeArguments: normalizeExecuteToolArgs,
         async execute(toolCallId, rawParams, signal, onUpdate, ctx) {
-            const params = autoNestFlatParameters(rawParams);
+            const params = normalizeParams(rawParams);
             const { tool_name, parameters } = params;
             // Find the tool
             const entry = registry.find((e) => e.definition.name === tool_name);

package/dist/app/tools/llm-analysis.js

@@ -219,7 +219,8 @@ export function createLlmAnalysisTool() {
                     model: MODELS[selectedModel],
                     messages,
                     effort_level: 'low',
-                    thinking_type: 'off'
+                    thinking_type: 'off',
+                    llmOperation: 'llm_analysis'
                 }, { signal });
             }
             catch (e) {

package/dist/app/tools/take-screenshot.js

@@ -121,7 +121,8 @@ async function defaultAnalyzeWithVisionLLM(screenshots, query, model, shortcutLl
             messages,
             max_tokens: SCREENSHOT_LLM_MAX_TOKENS,
             effort_level: 'low',
-            thinking_type: 'off'
+            thinking_type: 'off',
+            llmOperation: 'screenshot'
         }, { signal: signal ?? AbortSignal.timeout(SCREENSHOT_LLM_TIMEOUT_MS) });
     }
     catch (e) {